// Interceptor.attach(
//     ObjC.classes['MPCryptoService']['- generateRandom:'].implementation,
//     {
//         onEnter(args) {
//             // console.log(`-[NSConcreteMutableData appendBytes:${args[2]} length:${args[3].toInt32()}]`);
//             // console.log(hexdump(args[2], {length: args[3].toInt32()}))
//
//
//         },
//         onLeave(ret){
//             let a = new ObjC.Object(ret);
//             console.log('generateRandom', a)
//             let nsstr = ObjC.classes.NSString;
//             let ocstr = nsstr.stringWithFormat_('1111111111111111');
//             ret.replace(ocstr);
//             console.log('generateRandom2', new ObjC.Object(ret))
//
//         }
//
//     }
// )
// Interceptor.attach(
//     ObjC.classes['NSConcreteMutableData']['- appendBytes:length:'].implementation,
//     {
//         onEnter(args) {
//             console.log(`-[NSConcreteMutableData appendBytes:${args[2]} length:${args[3].toInt32()}]`);
//             console.log(hexdump(args[2], {length: args[3].toInt32()}))
//
//
//         }
//
//     }
// )
let base = Module.getBaseAddress('MTPotal');
console.log('base', base)
let module = Process.getModuleByName('MTPotal')
pass 0xb5a96000 check
Memory.scan(base, module.size, '65 03 11', {
    onMatch(address, size) {
        // console.log('match4', address, address.sub(1).sub(base).add(0x100000000));
        // console.log('\tnext',Instruction.parse(address.sub(5)))
        // console.log('\tnext',Instruction.parse(address.sub(9)))
        let b = address.sub(9)
        // console.log('bb', b.sub(base).add(0x100000000))
        let c = Instruction.parse(b);
        if (c.mnemonic == 'b.eq'){
            // console.log('....', c,'||', c.next)
            let cnext = Instruction.parse(c.next)
            // console.log('next', cnext)
            if (cnext.mnemonic == 'and'){
                let eqAddr = ptr(c.opStr.substring(1,)).sub(base);
                // console.log('\t',eqAddr)
                // console.log('\t',b.sub(0x70), ptr(c.opStr.substring(1,)))
                Memory.patchCode(b, 4, code=>{
                    const cw = new Arm64Writer(code, {pc: ptr(b)});
                    cw.putBImm(ptr(c.opStr.substring(1,)));
                    cw.flush()
                    // console.log('\t',Instruction.parse(b))
                })
            }
        }
    }
})
